Add TLS and mTLS support for Kafka

[ymocode]

Summary

• add optional TLS and mutual TLS support for Kafka publishers
• preserve Go CDK Kafka URL behavior, including key_name
• validate broker lists, boolean settings, custom CA files, and client certificate pairs
• require TLS 1.2 or newer and keep server verification enabled by default
• document Kafka TLS environment variables
• add focused configuration and certificate-loading tests

Verification

• go test -count=1 ./...
• go test -race -count=1 ./...
• go vet ./...
• go build -trimpath
• gofmt and git diff --check

Checklist

• Signed the Contributor License Agreement

[CLAassistant]

All committers have signed the CLA.